atomsilo

Executive Summary

AtomSilo is a medium-sophistication criminal threat actor specializing in ransomware operations with a primary focus on financial gain. Known for double-extortion tactics, AtomSilo uses initial access via the Atlassian Confluence vulnerability (CVE-2021-26084) and has targeted sectors such as healthcare and education. The group is suspected to be linked to BRONZE STARLIGHT, a Chinese state-linked actor, and has been active since December 2021.

Goals & Targeting

AtomSilo targets sectors with sensitive data or less robust cybersecurity defenses, such as healthcare and education. The group seeks to maximize financial gains through double extortion campaigns, where victims are coerced into paying ransoms or face public shaming via leaked data. Their strategic focus appears to be on disrupting organizational operations while leveraging high-profile attacks to establish notoriety in the ransomware landscape. Typical victims include mid-to-large sized organizations with accessible network entry points.

AtomSilo is a double-extortion ransomware group that emerged in late 2021, leveraging the Atlassian Confluence vulnerability (CVE-2021-26084) for initial network access. The group operates with a clear focus on financial gain, employing double extortion tactics where victims are threatened with data leaks if they fail to pay the ransom. AtomSilo's targeting patterns suggest a preference for sectors like healthcare and education, possibly due to their access to sensitive data or weaker defensive postures. The group has been linked to BRONZE STARLIGHT, a Chinese state-linked threat actor, further complicating its operational landscape. Known victims include organizations in North America and Europe, with one notable incident involving the deployment of high ransom demands (up to $1 million). AtomSilo's campaign patterns indicate a focus on disrupting operations while maximizing financial gain through sophisticated extortion schemes.

Key Capabilities

• Exploitation of Atlassian Confluence vulnerabilities (CVE-2021-26084)
• Double extortion ransomware deployment
• Spear-phishing campaigns for initial access
• Use of custom or known ransomware tools
• Data exfiltration and public leak threats
• Fast-flux command and control infrastructure

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

AtomSilo's campaigns typically involve phishing emails, exploitation of CVE-2021-26084, and deployment of ransomware with double extortion demands. The group appears to target organizations in the healthcare and education sectors, as seen in a notable attack on a US healthcare system in June 2022. Campaigns often include threats of data leaks to pressure victims into payment. Notable operations include high-profile attacks on educational institutions and healthcare providers, with a focus on maximizing financial gain through large ransom demands.

IOC Patterns

• Spear-phishing emails containing malicious links or attachments
• C2 communication over fast-flux DNS domains
• Web shell activity related to CVE-2021-26084
• Ransomware-related encryption patterns in file systems
• High volumes of outbound network traffic post-compromise
• Presence of encrypted files with specific extension patterns

Recommended Actions

• Patch all Atlassian Confluence instances and related software promptly.
• Implement multi-factor authentication for remote access tools.
• Monitor for unusual network traffic, especially DNS queries to unknown domains.
• Regularly back up critical systems and store backups offline.
• Educate employees on phishing email tactics and suspicious emails.
• Segment networks to limit lateral movement potential.
• Deploy endpoint detection and response (EDR) solutions.

Suggested Tags